T01 · Skill Instruction Hijacking
Error
- Location
src/memoryguard/provider_adapters.py:45- Finding
Agent-Callable Provider Installation Persistently Redirects Future Agent Memory Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Memoryguard
Security checks for vulnerabilities and agentic risk
Overview
MemoryGuard is a local memory manager, but it can persistently rewrite agent instructions and configuration, so users should review those changes before installing.
Install only if you are comfortable letting this tool modify agent memory instructions and MCP configuration. Prefer running provider setup manually from a trusted terminal, back up ~/.codex/config.toml and ~/.cursor/mcp.json first, avoid allowing untrusted prompts or repositories to invoke memoryguard_provider_install, and use project-scoped configuration where possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/memoryguard/provider_adapters.py:142- Finding
Provider Installation Can Overwrite Existing Configuration After Parse or Read Failure
- Content
View full analysis
str: try: return path.read_text(encoding="utf-8") except (OSError, UnicodeDecodeError): return "" def _write_text(path: Path, content: str) -> None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text(content, encoding="utf-8") def _load_json(path: Path) -> dict[str, Any]: try: data = json.loads(path.read_text(encoding="utf-8")) return data if isinstance(data, dict) else {} except (OSError, json.JSONDecodeError): return {} def _save_json(path: Path, data: dict[str, Any]) -> None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8") ``` Claude and Cursor installation then save the empty fallback as a replacement configuration: ```python mcp_path = self._mcp_config_path() data = _load_json(mcp_path) _set_mcp_server(data, MCP_SERVER_NAME, _mcp_server_config()) _save_json(mcp_path, data) ``` Codex installation has the same failure mode for text configuration: ```python mcp_path = self._mcp_config_path() toml_content = _read_text(mcp_path) section = _mcp_toml_section() new_toml = _replace_section(toml_content, _TOML_BEGIN, _TOML_END, section) _write_text(mcp_path, new_toml) ``` ### Technical Analysis The helper functions do not distinguish between: - A configuration file that does not exist. - A malformed JSON file. - A file encoded differently from UTF-8. - A permission or transient I/O failure. - An existing JSON value that is not an object. All of these conditions are converted into an empty string or empty dictio ...[truncated 1881 chars]- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Warning
- Location
src/memoryguard/mcp_client.py:395- Finding
Resource Discovery Executes Commands from Repository-Controlled MCP Configuration
- Content
View full analysis
list[dict[str, Any]]: path = Path.cwd() / ".mcp.json" data = self._load_json(path) if not data: return [] return self._parse_claude_servers(data.get("mcpServers", {}), "claude:.mcp.json") ``` Commands obtained from configuration are passed directly to `subprocess.Popen`: ```python def _start(self) -> None: if self._proc is not None: return full_env = {**os.environ, **self.env} cmd = self.command + self.args try: self._proc = subprocess.Popen( cmd, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, env=full_env, text=True, encoding="utf-8", errors="replace", bufsize=1, ) ``` Resource discovery launches every discovered server: ```python def discover_resources(self) -> list[dict[str, Any]]: """对每个已配置 server 调 resources/list，汇总返回。 单个 server 失败不影响其他。不调用任何 tool。 返回 [{server_name, config_source, resources, resource_count, error}]。 """ results: list[dict[str, Any]] = [] for srv in self.scan_all(): entry: dict[str, Any] = { "server_name": srv["server_name"], "config_source": srv["config_source"], "resources": [], "resource_count": 0, "error": None, } client = MCPClient(srv["command"], srv["args"], srv.get("env", {}), timeout=self.timeout) try: try: client.initialize() resource ...[truncated 2949 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (156)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Running external provider commands via subprocess while describing the skill as a memory backend is security-relevant undeclared behavior. Subprocess execution can expose the host to command misuse, unexpected file access, or interaction with untrusted binaries, especially in agent ecosystems where users may assume the skill only manages local memory records.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Step 2: Configure MCP
Add MemoryGuard to your Codex MCP config at
~/.codex/config.toml(Windows:%USERPROFILE%\.codex\config.toml):toml
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Step 2: Configure MCP
Add MemoryGuard to your Codex MCP config at
~/.codex/config.toml(Windows:%USERPROFILE%\.codex\config.toml):toml
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
Step 2: Configure MCP
Add MemoryGuard to your Codex MCP config at
~/.codex/config.toml(Windows:%USERPROFILE%\.codex\config.toml):toml
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
python ## Step 2: Configure MCP Add MemoryGuard to your Codex MCP config at `~/.codex/config.toml` (Windows: `%USERPROFILE%\.codex\config.toml`): ```toml
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code contradicts its stated security boundary by enumerating every hidden directory under the user's home directory via Path.home().iterdir() and then deriving metadata such as size, file count, modification time, and inferred product. Even without reading file contents, this is broad local reconnaissance that can reveal installed tools, activity patterns, and potentially sensitive hidden application directories unrelated to the declared agent profiles.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
python ), MemorySurface( surface_id="claude_user_settings", path_template="%HOME%/.claude/settings.json", surface_role="control_surface", scope="user", load_order=21, loader_evidence="https://docs.anthropic.com/zh-CN/docs/claude-code/memory",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python v2/ config.json # 配置 setting.json # 设置 credentials.json # 凭据（不读） tasks-index.sqlite # 任务索引 checkpoints/ logs/
Direct flow: pathlib.Path.read_bytes (file read) → pathlib.Path.write_bytes (file write)
High
- Category
- Data Flow
- Confidence
- 80% confidence
- Finding
Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.
- Content
python for patch in plan.patches: src = Path(patch.path) backup = workspace / BACKUPS_DIR / f"{src.name}.{stable_id('bak', patch.path)[:8]}" backup.write_bytes(src.read_bytes()) backup_paths.append(str(backup)) if patch.operation == "delete": src.unlink()